CVE-2026-100230: Input-Leap Input Leap

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.

Affected products

• Input-Leap Input Leap: up to and including 3.0.3

Published 2026-09-25. Last modified 2026-09-30.